Malware Spread Calculator

β = contactRate × infectionProbability; γ = 1 ÷ meanRemediationDays; R0 = β ÷ γ. Growth = β × (S ÷ N) − γ, and the doubling time is ln 2 ÷ growth. This is the standard deterministic SIR model applied to hosts instead of people. β captures how aggressively the malware reaches out and how often that lands, γ captures how fast your team removes hosts from the infected pool, and R0 is their ratio — the single number that decides whether an outbreak grows or dies. Because the model is deterministic and homogeneous-mixing, treat it as an order-of-magnitude prioritisation estimate rather than a prediction of specific hosts.

R0 tells you whether the answer is 'clean the infected machines' or 'pull the network cable', and that decision usually has to be made in the first hour with exactly these few numbers.

This calculator takes 7 inputs: Reachable hosts, Hosts infected at detection, Susceptible hosts contacted per infected host per day, Probability a contact succeeds, Hosts already immune — patched or hardened, Mean days to clean an infected host, Projection horizon. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Because it cuts the contact rate directly, and β is linear in contact rate. Halving reachable neighbours halves R0, which is often the difference between an outbreak that grows and one that burns out on its own.

No — real estates are clustered, so early spread is usually faster inside a subnet and slower between them than the model says. Use it to decide direction and urgency, not to forecast an exact host count.